This is an excellent overview of state-sponsored cyber attacks (NotPetya, Russian interference in US elections, Stuxnet, Iranian operations against Sheldon Adelson, ...), and makes the consistent and well supported argument that 1) cyber isn't like nuclear or other WMD which are primarily deterrents vs. actually used 2) cyber isn't useful for deterrence because attacks can't be well calibrated or predicted, and can't demonstrate ability to escalate clearly if not complied with.

A lot of the information about these attacks is more thoroughly reported elsewhere, but it did include some interesting and new-to-me information about US vs. USSR economic/espionage operations in the 1980s (where the US intentionally fed bad data and components to USSR to make suboptimal decisions and failed equipment -- most of this is still classified and not reported anywhere in detail that I've found.)

Overall, I tend to agree with the author that cyber isn't particularly like nuclear in any way, and is much more like traditional intelligence/influence operations.

A well-written and researched book about international cyber-espionage carried out by states against each other with collateral damage to major multinational corporations and national concerns like power plants and state banks. The author gives detailed histories, explanations, and analyses of these attacks and what their purposes were, whether overt or unknown. I learned a huge amount about something I knew little about, and I'm now a bit paranoid- the power of these weapons and attacks, and the lack of scruples by the perpetrators, is astounding. Many of the perpetrators are anti-Western states, such as Russia, China, Iran and North Korea, however several of their worst attacks were enabled by the theft of powerful hacking tools created by the NSA in the US- sort of like a biological weapon gone amok. I read this for a book group, and several people thought that it was too technical and overwhelmed them with facts, but I thought it was just right. ( )